www.it-connect.fr
Notion AI: Fireworks AI Hack Exposed Customer Conversations
Have you ever pasted a password or API key into a conversation with Notion AI? Then I have bad news for you: the hack of Fireworks AI, a provider used by Notion, exposed conversation transcripts. Here’s what we know about the incident.
Let’s be clear right away: Notion was not hacked. Its subcontractor Fireworks AI, an inference and training platform for open-weight models, was compromised. But since Notion used it to run the AI models offered in Notion AI and for the Insights feature, Notion users are indirectly affected.
On Fireworks’ side, the incident began in early October with the theft of secrets (API keys, tokens) from a limited number of customer accounts. That was where it seemed to end... until November 9, 2026, when Fireworks finally revealed that the attack had gone further. In fact, through a cloud provider compromised on October 23, the attacker reached its development machines the following day.
Following these incidents, data was stolen from Fireworks’ servers. This reportedly includes billing data and, for some customers, incomplete datasets and model weights.
The Timeline of Events According to Notion
For its part, the security bulletin published by Notion on November 10, 2026 outlines the sequence of events:
- November 2: Fireworks reports that a small dataset was accessed. According to Notion, it contains only synthetic test data.
- November 3: as a precaution, Notion disconnects from Fireworks, deletes all its data there, and stops ongoing training jobs.
- November 6: Fireworks warns Notion that customer data may ultimately have been accessed.
- November 8: Fireworks confirms the final scope of the compromised dataset.
- November 9: Notion contacts affected customers.
"After analyzing the dataset Fireworks AI provided to us on November 8, we discovered that it contained Notion AI conversation transcripts used for the Insights feature, which, for the vast majority of affected workspaces, were not attributable.", Notion explains. In other words, there was no author or associated workspace, and no tool-call results. More importantly, this incident affects very few Notion users: fewer than 1% of Notion workspaces. Still, the term "not attributable" is debatable: a conversation often mentions a customer, a project, or an email address.
As a precaution, Notion also says it revoked, on November 11, Notion API keys found in messages from affected users. Proof that secrets were circulating there...
Zero Data Retention, or Not
There is still an awkward point regarding user data protection. For Insights, Notion sent Fireworks the Notion AI exchanges it stores. Fireworks had contractually committed to retain nothing (zero data retention). According to Notion, however, data was kept on the Fireworks endpoints it used. Fireworks, for its part, says its ZDR services by default are not affected.
"Even though this was not a breach of our systems, protecting your data is fundamental [...]", Notion writes. Technically, that’s true. But third-party vendors still need to honor their commitments.
As a precaution, you may want to change any password, API key, or identifier you pasted into Notion AI.
